As reported by SecurityAffairs, the MikroTrick exploit chain targeting MikroTik RouterOS has moved from coordinated disclosure to mass exploitation in under 24 hours, with successful intrusions observed as early as September 2, 2026 — a day before MikroTik shipped patches. This is the textbook definition of a patch-gap zero-day: the vulnerability window existed before defenders even knew an update was available, and threat actors appear to have had advance visibility into the impending release.

Security Impact: As reported by SecurityAffairs, the MikroTrick exploit chain targeting MikroTik RouterOS has moved from coordinated disclosure to mass exploitation in under 24 hours, with successful intrusions observed as early as September 2, 2026 — a day before MikroTik shipped patches.

Why This Matters

MikroTik devices sit at the edge of SMBs, branch offices, WISPs, and critical infrastructure across Latin America, Africa, Eastern Europe, and Southeast Asia. They are the connective tissue for networks that rarely have dedicated security teams. A full-compromise chain that requires no credentials, no user interaction, and only SSH exposure is the exact scenario that converts a perimeter device into a persistent internal beachhead.

The chain pairs CVE-2026-67276 (SSH authentication bypass via forged RSA public key, CVSS 9.2 Critical) with CVE-2026-86060 (SSH session privilege escalation). Together they yield unauthenticated root on any internet-exposed RouterOS instance running SSH. The indicator — an SSH user literally named -2 — is an artifact of the bypass logic and should be treated as a confirmed intrusion marker.

Treat any internet-exposed MikroTik device with SSH enabled as compromised until proven clean. Do not assume the absence of visible anomalies means the device is safe — post-exploitation binaries in this campaign had zero detections on VirusTotal.

Vulnerability Details

CVESeverityImpactPatch Status
CVE-2026-67276Critical (9.2)SSH auth bypass via forged RSA keyPatched
CVE-2026-86060HighSSH session privilege escalation to adminPatched
Vulnerability Details
Fixed versions: RouterOS 7.25beta3, 7.24.2, 7.23.4, 6.49.21 (released Sept 3, 2026)
Exploitation in the wild: Confirmed by CERT Polska; IOCs include attacker IPs 82.192.72[.]4 and 103.102.31[.]18, backdoor user ops, and MIPS BusyBox 1.16.1 deployment via ftpsrv.py, launch.sh, serve.py
Most exposed: WISPs, SMB branch routers, IoT-gateway deployments, any RouterOS instance with SSH reachable from the internet

Immediate Actions

  1. Inventory and patch: Identify every MikroTik device; upgrade to 7.24.2 / 7.23.4 / 6.49.21 immediately. If upgrade is delayed, disable SSH from WAN in IP → Services.
  2. Hunt for compromise: Inspect /user for unexpected accounts (-2, ops, or any new admin). Review SSH authorized_keys, scheduled tasks, and system scripts.
  3. Block IOCs: Egress-filter 82.192.72[.]4 and 103.102.31[.]18 at perimeter. These IPs hosted the initial payload delivery infrastructure.
  4. Rotate credentials: If a device was exposed and potentially compromised, rotate all credentials it stores or proxies — including VPN keys, RADIUS secrets, and downstream admin logins.
  5. Constrain management: Move SSH to a management VLAN or VPN-only path. Disable Winbox and FTP from WAN. The era of exposing any RouterOS service directly to the internet is over.

Shield53 Recommendations

The patch-gap window here is the real story. Threat actors had working exploitation within 24 hours of disclosure coordination — implying either leak in the disclosure pipeline or independent rediscovery of the RSA verification flaw. Defenders must assume that any coordinated disclosure for popular edge devices carries immediate exploitation risk and pre-stage response runbooks accordingly.

  • Adopt a zero-trust edge policy: No RouterOS service should be internet-reachable by default. Use VPN overlays or jump hosts for management.
  • Enable auto-updates where supported or subscribe to MikroTik advisory feeds — the patch-gap cost is measured in hours, not weeks.
  • Deploy edge EDR or logging: Forward RouterOS logs to SIEM. The -2 user artifact would have been trivially detectable with basic account-creation alerting.
  • Plan for presumed breach: If you cannot confirm a device was clean before Sept 3, rebuild it from firmware rather than attempting cleanup. Persistent rootkits on MIPS devices are difficult to fully eradicate via config resets alone.

The MikroTrick campaign reinforces a hard truth for 2026: edge devices are the new endpoint, and the patch cadence for them must match the urgency we apply to workstations and servers. The defenders losing ground here are those who still treat router firmware updates as a quarterly maintenance task.